[00:20.170 --> 00:24.990]  Welcome back to Hacking Career Village. It has been so great to listen to so many wonderful
[00:24.990 --> 00:29.890]  presentations. We have people who are in various different stages of their career,
[00:29.890 --> 00:35.870]  trying to figure out what to do next, if they want to do anything next. So I'm really excited
[00:35.870 --> 00:43.070]  that Amelie Curran decided to present to us the idea of being a tech executive and then
[00:43.610 --> 00:48.410]  coming from an individual contributor and then maybe going back again. So Amelie,
[00:48.410 --> 00:51.790]  take us on your journey and give us your best insight.
[00:52.010 --> 00:57.890]  Great. So yes, you guessed it. This is a Lord of the Rings hobbit-themed talk. While I'm not a
[00:57.890 --> 01:01.990]  Tolkien nerd, I am a firm believer in the hero's journey of story and character development seen
[01:01.990 --> 01:06.950]  in many forms of pop culture. My first ever keynote had a slide where I sufficiently stole
[01:06.950 --> 01:11.270]  the story wheel from Dan Harmon and Jester Roiland's Rick and Morty, but I didn't really
[01:11.270 --> 01:16.890]  tell anybody. For me, I'm 45 and I've had every job title and role I ever thought I wanted to have
[01:16.890 --> 01:22.090]  and work to do by this point in my life. I count my blessings and consider myself lucky.
[01:22.290 --> 01:27.010]  Along the way, I've had two marriages, several cats, a few cross-country moves, and even managed
[01:27.010 --> 01:31.450]  to transition genders. I didn't just get my cake and eat it too, I demolished the entire fucking
[01:31.450 --> 01:35.990]  bakery, croissants and all. But what does that mean to you, the lucky visitor to this digital
[01:35.990 --> 01:40.370]  corner of the world and audience member for my talk? Well, I know plenty of you are at various
[01:40.370 --> 01:44.190]  points along your life and career and I know no matter who you are, you're looking for answers
[01:44.190 --> 01:48.390]  to burning questions and even though I'm here talking to you, I seek them out myself.
[01:48.790 --> 01:53.310]  A brief background on me. My day job is essentially now that of a professional storyteller,
[01:53.310 --> 01:58.190]  but in tech parlance, they call me a technology advocate and I work for Splunk as of December 2019.
[01:58.650 --> 02:01.810]  Prior to that, I spent a little over a decade in public service for the federal government
[02:01.810 --> 02:07.790]  as a contractor, member of technical staff of an FRDC, and over nine years as a federal employee
[02:07.790 --> 02:12.710]  starting at the U.S. Department of the Interior, treasuring finally at HHS with a rotation working
[02:12.710 --> 02:17.990]  cybersecurity and IT modernization policy at the White House. All before that, I left college with
[02:18.090 --> 02:24.210]  a degree I was told that was useless in society as it stood, decision science, and started my career
[02:24.210 --> 02:28.550]  as a user interface designer and most of my classmates went directly into tech consulting.
[02:28.550 --> 02:33.990]  This was obvious during the dot-com boom and I decided to dot-com things just as it imploded.
[02:34.250 --> 02:39.010]  Do not count on me for reading economic trends, friends. I moved up during that time to a systems
[02:39.010 --> 02:43.950]  engineer and managed to get my first job involving security in 2000 and my first official title as
[02:43.950 --> 02:48.990]  such in 2003 working for a power company as part of a two-person security engineering team for a
[02:48.990 --> 02:55.830]  fortune 125 company. Ah yes, the good old days of slammer, hurricanes, and blackouts. During those
[02:55.830 --> 03:00.370]  three formative years, I transitioned from an individual contributor on a team to somebody who
[03:00.370 --> 03:05.470]  was leading teams of others. While the first team was small, about four people, when I left government
[03:05.470 --> 03:11.170]  last year, I led about 150 people of both federal employees and contractors. This is not always a
[03:11.170 --> 03:16.190]  growth curve and responsibility everybody here will desire, but some will. To each your own
[03:16.190 --> 03:21.830]  on this journey and that's what I'm here to speak about today. Back in the day, I was all idealistic
[03:21.830 --> 03:26.430]  thinking back to when I first was introduced to BBSs in the late 1980s and wondering that I may
[03:26.430 --> 03:30.530]  have put my dreams of being an astronaut or veterinarian on hold for chasing down this
[03:30.530 --> 03:35.770]  computer stuff. I mean, I doubt anybody then was going to expect we go from modems to high-speed
[03:35.770 --> 03:40.590]  direct-to-the-home fiber optics in less than 20 years and what was the domain of kids in their
[03:40.590 --> 03:44.770]  basements would end up being the most amazing invention of the 20th century or perhaps all of
[03:44.770 --> 03:50.970]  mankind. I hit college with an idea that yes, this technology thing is something, but what do I want
[03:50.970 --> 03:56.250]  to do? So I started as an electrical engineering and computer engineering major who sucked at coding
[03:56.250 --> 04:01.330]  and wanted to do something more applied. At the time, computer security topics were just covered
[04:01.330 --> 04:06.370]  undergraduate programs of which my work-study job supported, the Information Networking Institute.
[04:06.630 --> 04:11.250]  I changed majors twice to basically survive, but I still wanted to seek applied computing,
[04:11.250 --> 04:16.670]  basically how folks used what we now have. This is what I call the start of a career. Granted,
[04:16.670 --> 04:20.950]  nowadays this is what can be had in high school, but then it's usually after an initial stint in
[04:21.050 --> 04:25.390]  a post-secondary education, whether it be a four-year college or university or trade schools
[04:25.390 --> 04:31.350]  or community colleges. What most of this progress process really teaches you is how to gather and
[04:31.350 --> 04:35.770]  organize your knowledge and thoughts to manage output. Yes, learning particular point skills,
[04:35.770 --> 04:39.750]  especially in security roles, is now available in what is typically makes up these degrees and
[04:39.750 --> 04:43.930]  certification programs, but as somebody who's hired quite a bit over the years, I value how
[04:43.930 --> 04:49.870]  people are curious and put their thoughts together. So starting out, unless you're literally starting
[04:49.870 --> 04:53.810]  your own company, dropping into the family business, or get literally recruited to be
[04:53.810 --> 04:58.590]  the manager or director out of college, well, commissioned military officers are a whole other
[04:58.590 --> 05:03.510]  story, you're going to be joining an organization as an individual contributor. What that means is
[05:03.510 --> 05:08.450]  that you were hired for an initial skill set an organization needed. This also doesn't mean that
[05:08.450 --> 05:13.870]  this is all you will ever do. They expect you to learn and contribute, but typically in their way
[05:13.870 --> 05:18.570]  of doing business aligned to their market or mission. This is not to say that this is not
[05:18.570 --> 05:24.470]  useful or non-transferable. No, just the peculiarity of the business. Oddly, these business processes
[05:24.470 --> 05:29.510]  and methods are often covered as trade secrets, and they do likely protect them. And many ways
[05:29.510 --> 05:34.190]  of doing that is keeping employees happy and content. Again, if you see a lawsuit proposed by
[05:34.350 --> 05:39.390]  a company because some high ranking or major category lead and left for another competitor,
[05:39.390 --> 05:43.450]  the lawsuit is not just there to be officious, but they're protecting those trade secrets and
[05:43.450 --> 05:49.890]  that that person may have. You are a valuable asset. Sadly, not all organizations see that worth
[05:49.890 --> 05:55.730]  and treat you as such. For me, early in my career, I was trying to find that niche, and I'm sure many
[05:55.730 --> 06:01.270]  of you or are still trying to find it. It may take a few places to figure that out, and fine,
[06:01.270 --> 06:06.310]  especially in the security arena. You could start in a sock working crazy or shitty hours,
[06:06.310 --> 06:12.690]  or make, like the variety, this could be your jam. Maybe pivot to IRIH work, then to forensics,
[06:12.690 --> 06:18.850]  maybe RE. The amazing part, at least this career, is it's got a lot to explore. And as I noted prior,
[06:18.850 --> 06:24.850]  if you're curious, it will serve you well. For me, as I started to think about leadership roles,
[06:24.850 --> 06:29.530]  whether it be a line manager or all the way to wondering if I'd ever be a C-level tech exec,
[06:29.530 --> 06:34.530]  I figured a broad background would serve me well. However, not everybody wants to move up
[06:34.530 --> 06:38.530]  in management. But unfortunately, the tech sector is still grappling with how to manage highly
[06:38.530 --> 06:43.150]  skilled and competent technical talent, and not to recognize that some wish to remain individual
[06:43.150 --> 06:49.310]  specialists and contributors, and not be a team or group lead, or even an exec. Not every high
[06:49.310 --> 06:53.670]  performer has the skills to lead people on projects. And it's another entirely different
[06:53.670 --> 06:58.810]  skill set from one from core competencies for some specialists. And this is where we approach
[06:58.970 --> 07:04.350]  a fork in the road. At the point at which the realization that you may or may not want to move
[07:04.350 --> 07:08.810]  into leadership or management will usually occur between the times you're considered junior,
[07:08.810 --> 07:12.270]  and where you can be considered a seasoned professional with a number of projects and
[07:12.270 --> 07:17.070]  deliverables under your proverbial belt. I know the quandary that many folks in the security
[07:17.070 --> 07:21.330]  community have when trying to sell the value of an information security program to non-technical
[07:21.330 --> 07:26.370]  leaders and executives. It's selling the value of zero. I gave a talk on the concepts of zeros in
[07:26.370 --> 07:31.550]  organizations a few years ago for all day DevOps. Most security work is to work towards zero
[07:31.550 --> 07:36.730]  occurrence of an event or get close to zero, while many other roles seek to maximize your roles
[07:36.730 --> 07:41.990]  than to minimize. This is also seen in safety roles. And similarly, public perceived value
[07:41.990 --> 07:46.490]  is difficult to quantify and qualify because the lack of being in the news is beneficial.
[07:46.490 --> 07:50.870]  This can strangely be seen by a challenge that healthcare and other public safety officials have
[07:50.870 --> 07:56.930]  had to deal with during the pandemic. It's also hard to put a review that you've prevented a lot
[07:56.930 --> 08:01.270]  of stuff from happening. Since documenting it proves challenging and having to quantify
[08:01.890 --> 08:07.310]  what the impacts could have been in hypotheticals is a tough game to play and can lead folks to a
[08:07.310 --> 08:12.870]  challenge. Challenging your estimates and hyperbole is really kind of a no-win situation.
[08:13.690 --> 08:19.490]  So what are you to do to advance your career? Well, first off, don't get dismayed. The folks
[08:19.490 --> 08:23.090]  who can see the value work rather than just tabulate numbers will be the places where you
[08:23.090 --> 08:27.490]  want to work. However, those are a bit harder to come by, but things are getting better.
[08:28.750 --> 08:34.030]  Another tactic is finding a raft of good peers. This is your fellowship. This doesn't mean that
[08:34.030 --> 08:37.950]  you have to bounce onto a new role when they do, but this is some informal parallel between
[08:37.950 --> 08:43.950]  mentorship and support. I've kept in touch with a lot of former co-workers and such both let them
[08:43.950 --> 08:49.770]  hear to vent and like to hear from them and share my problems in kind. Share the challenges and
[08:49.770 --> 08:55.590]  successes I've had as well as share in those in kind as well. Sometimes when you need a hand
[08:55.590 --> 09:00.530]  sideways or a hand up they may be able to help you as well. This is more of an informal form
[09:00.530 --> 09:05.530]  of networking but just as useful as more formalized online sites and professional networking groups.
[09:06.110 --> 09:10.910]  So back to skills development for a moment. Say you're at three to five years in your
[09:10.910 --> 09:16.050]  professional career and you're finally deciding that what you may want to specialize in. First
[09:16.050 --> 09:22.230]  off I'm sure you'll like wait three to five years in? Yeah. Your first one to two years will
[09:22.230 --> 09:26.550]  probably be figuring out how to work in an organization, feeling out what like the culture
[09:26.550 --> 09:31.430]  is like, learning how to work within the processes and structure. I mean I had non-pro jobs while in
[09:31.430 --> 09:35.590]  high school working at a convenience store and a pizza delivery which had their own rules and
[09:35.590 --> 09:39.350]  culture but I wasn't anywhere to the point of calling them a career any more than they were
[09:39.350 --> 09:44.150]  pickup jobs during my pre-adulthood. But the two to five years is where you start to build up that
[09:44.150 --> 09:50.150]  launching pad of skills. The core knowledge you will expand upon. This doesn't need to be formalized
[09:50.150 --> 09:54.670]  either. In fact my work as a hobby got me the practical skills that formed the basis for my
[09:54.670 --> 09:59.770]  security career. All unpaid, all essentially unsponsored, but that extracurricular skills
[09:59.770 --> 10:05.830]  development is useful. About the third year in your company if you are on that first or fifth
[10:05.830 --> 10:11.010]  will have programs hopefully for training and other skills building. Take them up on those offers.
[10:11.010 --> 10:15.110]  Those are usually the first to go when the budget belt tightening occurs unless it is literally
[10:15.110 --> 10:20.390]  built into an audible benefit that they offer. When it's not formalized and I can tell you as
[10:20.510 --> 10:24.730]  a manager for many years a good boss will fight to carve out training expenses for their teams
[10:24.730 --> 10:30.070]  and see the value of professional development. I've gone to the carpet many many times to ensure
[10:30.070 --> 10:34.750]  my team has had at least one to two training experiences even if some may be non-technical.
[10:34.790 --> 10:40.290]  They can still network with peers. Fostering continuous education will be the greatest asset
[10:40.290 --> 10:45.230]  to your career regardless of which path you choose to take. Realizing that skills are not
[10:45.230 --> 10:49.370]  evergreen and require refreshing is another. Knowing that you will need to adapt to the
[10:49.370 --> 10:53.910]  changing face of business and environments you will operate will ensure that you will continue
[10:53.910 --> 10:58.690]  to be able to call a career as you inevitably age. But this isn't saying that you can't carve
[10:58.690 --> 11:03.110]  out a corner and specialize but you have to ensure that you're also innovating in the right way and
[11:03.110 --> 11:08.270]  being useful as a resource. As much as some cockles that get raised when somebody raises
[11:08.270 --> 11:13.790]  the spectra of a rock star or a luminary, either they will be a momentary flash in the pan or they'll
[11:13.790 --> 11:18.410]  be required to constantly reinvent themselves. Continuous learning ensures that you can always
[11:18.410 --> 11:24.450]  build on what you have and not be that one-hit wonder or rock star. So let's broach the rock star
[11:24.450 --> 11:29.930]  discussion for a moment. Like most rock stars it seems, and I've met a few, the actual musician
[11:29.930 --> 11:34.910]  rock stars, they may lack a little bit in the soft skills department because they've often hyper
[11:34.910 --> 11:38.850]  focused on the skills development of their core work but haven't worked on the soft skills that
[11:38.850 --> 11:44.870]  make them interact with people as a human. There's plenty examples of those infosec rock stars being,
[11:44.870 --> 11:50.510]  to put it lightly, assholes. Particularly to the new people in the career space. There are exceptions
[11:50.510 --> 11:54.530]  and those are the good ones. They often forget that they were not all born with what they have
[11:54.530 --> 11:59.170]  and remembering that helps you get a career progression. Ego is not something that people
[11:59.170 --> 12:04.510]  will suffer well and it's easy to break. As I've said in other talks, when hiring people
[12:04.510 --> 12:09.310]  I much prefer the reliable and skilled roadies and sidemen than the star or front men of a band
[12:09.310 --> 12:14.670]  because they show up every day, do their job, and because their employment is based on how well they
[12:14.670 --> 12:19.910]  do their job, usually have a vested interest in the outcomes. It's hard to think that some jobs
[12:19.910 --> 12:25.510]  are so at will as such but the best combatant against that is being an exceptional contributor.
[12:25.730 --> 12:30.410]  It's also a case of balancing and not getting abused by a boss or a peer and that's the next
[12:30.410 --> 12:36.330]  piece in the career to plan for. Again, I've been in the show for over 20 years and I've had
[12:36.330 --> 12:41.410]  the opportunity to walk away and to be honest, the idea has crossed my mind more than a few times.
[12:41.590 --> 12:47.190]  Just light a match, burn it all down. The flip side of worrying about what's next is also
[12:47.190 --> 12:52.210]  something that hangs over as a cloud. Often those thinking of making a radical change or a leap to
[12:52.210 --> 12:56.430]  something different burn a candle at both ends. A day gig and then the build-up of the next thing,
[12:56.430 --> 13:02.770]  be your own boss or a new venture. It's trying, it's stressful and it's not for everybody.
[13:02.770 --> 13:07.510]  But this is another route to use your experience to be a leader. Even if the goal is to flesh out
[13:07.510 --> 13:11.950]  and build out an idea with a goal of being later acquired, the opportunity exists to stretch your
[13:11.950 --> 13:17.190]  legs and see if you can cut it. At best, you can go back to being an individual contributor,
[13:17.190 --> 13:21.990]  go further into management or cash out and live other dreams. You're writing your own story.
[13:22.370 --> 13:26.050]  So that's all well and good for those who are less risk averse. You mentioned that you were
[13:26.050 --> 13:30.370]  all over the map. Yeah, I was. And it seemed like working for a lot of well-established
[13:30.370 --> 13:35.670]  organizations, especially the government. What about that? Well, I'm glad you asked.
[13:35.690 --> 13:39.410]  And to say that this wasn't a route I valued for my own needs would be disingenuous.
[13:39.430 --> 13:43.930]  I had and still have a lot going on in my life where I value the rough sense of some bankable
[13:43.930 --> 13:48.750]  security. Technically, public service is one of the few places that rarely sees layoffs. And if
[13:48.750 --> 13:53.070]  they do a reduction in force, known in the private and public sector as a riff, there's a lot more
[13:53.070 --> 13:58.710]  justification for seeing the door than on a whim, especially if you're a high performer. Safety,
[13:58.710 --> 14:04.150]  or the perception of it, is a good thing if you're trying to do a lot. The fact that there's
[14:04.150 --> 14:09.330]  something tangible and reliable there is good. This is why folks may call it the daily grind,
[14:09.330 --> 14:13.170]  but it's what others will base an entire career doing, and it often affords them a lot of
[14:13.170 --> 14:18.170]  intangibles. This is not to say a smaller company, startup, or even deciding to pull up roots and
[14:18.170 --> 14:24.110]  become an expat or go on a sabbatical isn't going to offer benefits either. They will, but it's up
[14:24.110 --> 14:31.390]  to you to evaluate what your needs are. Well, how do I evaluate my needs? This is essentially where
[14:31.390 --> 14:36.650]  the rubber hits the road. This is where you need to do a little planning. This isn't locked in,
[14:36.650 --> 14:41.810]  carved in stone, but an idea, given your experiences and desires and dreams, about where you want to be
[14:41.810 --> 14:46.970]  or see yourself being in a few years. It can have a timeline or can just be an endpoint with no
[14:46.970 --> 14:51.230]  planned speed. For me, I had hoped to possibly become a C-level techie and at some point in my
[14:51.230 --> 14:55.930]  career I just wasn't expecting that opportunity, even if it was for a smaller org, by the time I
[14:55.930 --> 15:00.750]  turned 45. Your timeline or desires may be different, possibly even fueled by your experience with
[15:00.750 --> 15:06.570]  working for and with individuals you may have a role that you desire. This is where we get to the
[15:06.570 --> 15:11.930]  one ring part of the story. Sometimes this overall exposure to what some can term the brass ring
[15:11.930 --> 15:16.890]  can be toxic, much like Smeagol and Gollum, and the exposure to the dog-eat-dog boiling
[15:16.890 --> 15:21.510]  crab pot of the corporate and even public sector world of ladder climbing can cause significant
[15:21.510 --> 15:27.270]  change in who you may be. The desire for more, greater and perceived better, can change a person
[15:27.270 --> 15:31.910]  if they drive themselves too hard thinking that the next rung is going to make them happy along
[15:31.910 --> 15:38.750]  with perceived success. They will step and crush on whoever seems an impediment to that path,
[15:38.750 --> 15:42.550]  break relationships and go through the world with a single-minded purpose at the expense of
[15:42.550 --> 15:46.690]  nearly everything that doesn't generate forward movement. All I have to say is,
[15:46.690 --> 15:52.750]  you can't take it with you. For a lot of us, and as I noted earlier, is that our curiosity fuels
[15:52.750 --> 15:58.150]  our passions for this job or career that we chose to have. Nobody forced us into it. Well,
[15:58.150 --> 16:02.390]  maybe a parent wondering if this is better than being a doctor. So we're here by our own free
[16:02.390 --> 16:06.570]  will, so why not enjoy the journey? I mean, typically if you're working from the age of 18
[16:06.570 --> 16:12.210]  to 20 to 65 to 67 years old, perhaps longer, that's 45 or so years of hopefully gainful
[16:12.210 --> 16:16.670]  employment in doing something that you love to do. It's really not a dash and more hopefully
[16:16.870 --> 16:21.010]  a leisurely stroll or hike, a marathon if you're really trying to torture the metaphor for the
[16:21.010 --> 16:27.070]  runners. Smell the flowers, enjoy the scenery. Granted, there's some externalities here which I
[16:27.070 --> 16:32.230]  may gloss over, which is the bias, even though illegal in many forms, towards race, gender,
[16:32.230 --> 16:36.470]  sexuality, disability and other characteristics which really shouldn't have any bearing on how
[16:36.470 --> 16:41.070]  good you are for a given role or opportunity. This particularly comes in play for minorities
[16:41.070 --> 16:47.150]  within a given field, whether it be gender, race, socioeconomic background, or LGBTQ status. And
[16:47.150 --> 16:53.030]  when you stack them, it becomes even a bit more complex. And while I won't go into the discussion
[16:53.030 --> 16:58.150]  about how much about diversity here, I want to make a point of the fact that this seriously
[16:58.150 --> 17:02.530]  changes the calculus for many in their careers. And this is something serious to consider both as
[17:02.530 --> 17:07.250]  one in the career and those who are in charge of hiring and leading those teams and efforts.
[17:07.330 --> 17:11.010]  There are plenty of other better talks on this than I can give at this moment,
[17:11.010 --> 17:14.810]  so I wanted to at least bring this up to your attention and note that this is still very much
[17:14.930 --> 17:21.110]  a going concern. Once you've walked the path for a while here, looking at your preferred end role or
[17:21.110 --> 17:27.670]  state, you're considered a senior level material. And this is what can be construed with a few more
[17:27.670 --> 17:33.970]  lines and occasional less than natural colored hair of gray. Then you may get plucked to be asked
[17:33.970 --> 17:39.690]  the question, would you like to be a manager? And this may give some folks pause. One, they didn't
[17:39.690 --> 17:45.870]  ask to see the manager unless you're the person asking was a Chad or Karen, so double check. But
[17:45.870 --> 17:50.310]  what they asked is, you have the possibility demonstrated enough leadership qualities in
[17:50.310 --> 17:54.830]  order to be considered a good candidate, not just to be an individual contributor to a team or
[17:54.830 --> 17:59.610]  project, but to actually lead it. Granted, you could be asked this sooner if you displayed an
[17:59.610 --> 18:03.890]  early aptitude for it. But usually after you found your way with what you want to do, got the ropes
[18:03.890 --> 18:08.610]  of an organization or two, and I've had some history to point on for some successes and yes,
[18:08.610 --> 18:15.770]  failures. For some, this comes with an exclamation of cool, or awesome, or even maybe a dance in your
[18:15.770 --> 18:21.830]  cube. Others, it may be an oh shit moment. Because this potentially ends the comfort of isolation
[18:21.830 --> 18:26.090]  or just being part of a team, or better yet, not being responsible for anything other than your own
[18:26.090 --> 18:30.990]  work. However, for those that are in the crux of this decision point, there's hope if you play it
[18:30.990 --> 18:36.050]  right. Some come to this point worrying if they will be able to maintain their technical focus
[18:36.050 --> 18:41.270]  and chops if they decide to become a leader or manager. The short answer is yes, but it comes
[18:41.270 --> 18:46.370]  with some caveats. The further you move up the leadership chain, the more divorced by design you
[18:46.370 --> 18:51.610]  will become from the day-to-day minutia. If you think you can go back and pull every oar and steer
[18:51.610 --> 18:56.870]  every rudder of your fleet of ships, disabuse yourself of that idea entirely. The same aspects
[18:56.870 --> 19:02.810]  of managers you hated who may have been dictatorial or micromanaging in their roles, you just adopt it.
[19:02.810 --> 19:07.670]  Just don't. Your job is to find and raise up trusted lieutenants, and by that I don't mean
[19:07.670 --> 19:12.110]  sycophants, but find the right talent to raise up and effectively fill the gap you and others may
[19:12.110 --> 19:16.610]  leave when they progress to the professional development life cycle.
[19:17.810 --> 19:22.010]  Essentially, you also inherit the role of talent scout, and when I mentioned before about taking
[19:22.010 --> 19:26.390]  advantage of training opportunities you had early on to keep you sharp, you are now directing that
[19:26.390 --> 19:31.070]  role, so I hope you learned something then. This doesn't sound like maintaining my technical job,
[19:31.070 --> 19:36.250]  she's saying, but you're just leveling up. I know folks like to code, work hands-on with hardware,
[19:36.250 --> 19:41.570]  and so forth. I get it, I miss the chase of IRIH work and building up a network of network defense
[19:41.570 --> 19:46.130]  systems. However, I feel that the benefit from being a senior level individual is the experience
[19:46.130 --> 19:51.070]  and lessons learned that you can impart to others. My own jump from engineer to architect
[19:51.070 --> 19:55.750]  worked that way as it gave me a broader view of the mission and business we were doing. I got to
[19:55.750 --> 19:59.930]  work with a lot of other people with other skills and help bridge the gaps in understanding and
[19:59.930 --> 20:05.190]  communication across various teams and business units. The key point is not to be cynical about
[20:05.190 --> 20:10.550]  the fact that you're possibly now in charge and that as much as all the crap that may roll up to
[20:10.550 --> 20:14.970]  you, the accolades may also be the first to hit you. How you balance it is where you start to
[20:14.970 --> 20:19.630]  succeed as a leader. This is about the time where I started to broaden out my own background.
[20:19.630 --> 20:24.050]  As I noted, I did the system engineering and started into architecture, but I also started
[20:24.050 --> 20:27.790]  into compliance policy work. I figured if the compliance people were going to grade me on my
[20:27.790 --> 20:32.190]  engineering and architecture skills, it may be about time for me to walk a mile or so in their
[20:32.190 --> 20:36.590]  shoes. It gets you to re-examine your approaches and how and why you do your work. And because it's
[20:36.690 --> 20:39.910]  a different layer and working with different types of people, it delivers some skills you
[20:39.910 --> 20:44.950]  wouldn't normally get if you hyper-specialized. As much as folks will push the red, blue, and purple
[20:44.950 --> 20:49.210]  team and any other color that's in vogue right now as a way to run multiple angles of learning
[20:49.210 --> 20:54.310]  about offensive and defensive sides of operational security, the policy arena is also a way to take
[20:54.310 --> 20:59.030]  the tabletop or live fire aspects to another level. I know many will think that policy is
[20:59.030 --> 21:03.810]  merely just coming up with ways to be more efficient. However, a good policy people will
[21:03.810 --> 21:07.670]  examine things from every angle they can, thinking about scenarios the same way a defensive or
[21:07.670 --> 21:13.690]  offensive team would, to ensure it's the best way to apply and govern a policy. In other cases, you,
[21:13.690 --> 21:18.470]  if you end up doing policy work, may be on the front lines of a new technology proposal or action
[21:18.470 --> 21:23.270]  or other event and need to quickly react and develop a working framework for how to handle
[21:23.270 --> 21:28.210]  everything. It requires a nimble mind with a deep background and experience in the topics of policy
[21:28.210 --> 21:33.910]  is to cover, and then some. You'd be surprised, but some of those policy wonks are pretty awesome
[21:33.910 --> 21:39.230]  people and really interesting way to expand their applied skills when you may feel a little bit of
[21:39.230 --> 21:43.810]  techie burnout. Given all of this, you'd think you'd be nearing an end, and yeah, it's kind of
[21:43.810 --> 21:48.610]  near there. By this point, you probably have touched about every little aspect of this career
[21:48.610 --> 21:53.010]  space and even getting to speak at conferences like this and others, potential volunteering and
[21:53.010 --> 21:58.830]  giving a little back, but you're now about to decide, do I stay or do I go? And by that, I mean
[21:58.830 --> 22:04.450]  being a leader is a lot of work, a lot of paperwork, emotional labor, and a lot of time. You need to
[22:04.450 --> 22:08.810]  essentially still find those balance points in order to not burn or flame out. Say you've been
[22:08.890 --> 22:13.430]  a senior leader for a time, it's okay to go back to an individual contributor role like from when
[22:13.430 --> 22:19.310]  you started. The answer is a resounding yes. In fact, it should almost be standard practice. For me, I'd
[22:19.310 --> 22:24.170]  been a manager again for about five years before I realized I needed a break from the stress and
[22:24.170 --> 22:29.630]  the politics. That stuff I mentioned before, especially the emotional labor, will wreck you if
[22:29.630 --> 22:35.270]  you give a hoot about your staff and your work. I know a lot of folks will say to try to separate
[22:35.270 --> 22:39.990]  work from the people, but when you're doing things that has a good mission and a potential,
[22:40.430 --> 22:45.690]  it's a very hard thing to do, even when you think you can easily do it. As a leader, the relationships
[22:45.690 --> 22:50.530]  you developed are useful in order to get things done, but as part of building trust, people will
[22:50.530 --> 22:56.910]  open up to you and get invested. In a way, you can say that this is the I care too much issue, but it
[22:56.910 --> 23:02.270]  happens. Then again, besides all that, you may want to take a break, try something new, that continuous
[23:02.270 --> 23:06.710]  learning stuff, and build a skill set that you don't have or feel you may need to advance even
[23:06.710 --> 23:12.170]  further if you are a senior leader or executive. For me, when I started as a deputy CIO for a federal
[23:12.170 --> 23:16.810]  agency component, I was thrown into areas I had no formal training in, including budgeting, human
[23:16.810 --> 23:21.830]  resources, and more formalized project management. I had people who had PMP certifications working for
[23:21.830 --> 23:26.150]  me. I ended up hiring a budget officer to help with our budget management and procurements and
[23:26.150 --> 23:31.430]  contracts. Well, this may sound like a cop-out as to why don't you do it yourself? Well, the answer
[23:31.430 --> 23:35.950]  is I try. I worked with these folks, but I also knew that they knew way more than me and did a
[23:35.950 --> 23:40.150]  better job of it. This is the sign of a good leader, which is to know where your expertise
[23:40.150 --> 23:46.270]  and quality ends and somebody else's begins. It's not ego. In fact, it's humbling.
[23:46.270 --> 23:51.850]  Know when to ask for help. Know when to delegate. Know when to hold them. Know when to fold them.
[23:51.850 --> 23:57.130]  It's an important skill that many CTOs, CIOs, and CISOs I know definitely do not do, but could also
[23:57.130 --> 24:00.870]  ease their lives if they admitted that they can't do it all. This is a bit of the Type A
[24:00.870 --> 24:05.070]  control freak personality type that draws some people to leadership, but they will also fizzle
[24:05.070 --> 24:10.570]  out over time or move on and create a potential other disaster. As I moved on, I realized I needed
[24:10.570 --> 24:14.330]  to learn better communication skills. The last few positions I had for the federal government had
[24:14.330 --> 24:19.870]  yearly reviews that constantly harped on this. I was also always eager to go and speak, work on
[24:19.870 --> 24:24.970]  those skills in a more public forum. You obviously hear me here and see me now, so part of this is
[24:24.970 --> 24:30.270]  working out. However, one of these experiences I didn't have in my career, and especially in a
[24:30.270 --> 24:34.470]  particular sector, was working for a vendor. And as such, in a role that is now strangely
[24:34.470 --> 24:39.330]  considered part of marketing, is that of an advocate. Now, many will look at such roles
[24:39.330 --> 24:43.910]  and think, well, that's just a pitch man or pitch woman, and it's no better than sales,
[24:43.910 --> 24:48.250]  but it's really not. In fact, many of the senior folks here, goons, speakers, and such,
[24:48.250 --> 24:52.170]  actually have roles similar to mine. It's an educational role as much as a customer-facing
[24:52.170 --> 24:56.310]  and interaction role that not only requires being able to speak intelligently about a topic,
[24:56.310 --> 25:01.670]  but also listening. Listening is a very underutilized skill among techies at times.
[25:01.970 --> 25:06.310]  Obviously, you're here and listening to me, but actively listening in order to synthesize a useful
[25:06.310 --> 25:10.890]  interaction with a customer or teammate or executive is a very useful skill to develop.
[25:11.070 --> 25:15.730]  Much like critical thinking is as much an innate skill for people and important in navigating
[25:15.910 --> 25:19.030]  a career development, the refinement of communication and listening skills are the
[25:19.030 --> 25:23.910]  ones that will mature over time as well. As an advocate, I get to touch many parts of our
[25:23.910 --> 25:28.490]  organization. I get to develop strategies for all sorts of things for a very broad viewpoint,
[25:28.490 --> 25:33.350]  but also get to dig into some passion areas. It's outward and inward facing. If it wasn't
[25:33.350 --> 25:36.330]  for the pandemic, I'd have been on the road for a significant part of the time,
[25:36.330 --> 25:40.410]  which is something new and interesting for me. I can freely admit that some of it was
[25:40.410 --> 25:43.890]  possibly to build up some frequent flyer and hotel points for eventual time off,
[25:43.890 --> 25:48.590]  but those are some things, the fringe items you consider when making changes like that.
[25:48.590 --> 25:52.150]  I'm about eight months into slipping back into individual contributor role. It's drastically
[25:52.150 --> 25:56.370]  different from my prior C-level role, but also somewhat similar because I'm looking at interactions
[25:56.370 --> 26:00.590]  with people at my former level from a different perspective. Conversely, I'm getting time to
[26:00.590 --> 26:05.230]  explore a few things I wasn't allowed to do or have the time or resources to pursue. There's a
[26:05.230 --> 26:09.490]  lot of these considerations for changes. My boss says, be comfortable being uncomfortable, which
[26:09.490 --> 26:13.770]  is actually a really good bit of guidance. We are typically kind of risk adverse in our roles
[26:13.770 --> 26:17.590]  and lives, and we value the basic needs of housing, food, and sleep, maybe a good hot
[26:17.590 --> 26:22.230]  shower on occasion. So we tend to sit there until we have to move. This is a skill while
[26:22.230 --> 26:26.870]  you have your day-to-day is encouraging to walk the knife edge and explore new things and new
[26:26.870 --> 26:32.090]  ways of looking at it. To be honest, it's one of the best moves I've made. However, my desire is
[26:32.090 --> 26:36.530]  still to go back into leadership. I figure that the skills I develop here will support what it
[26:36.530 --> 26:41.090]  needed to be to be a more effective executive when I hopefully return to those ranks, or with
[26:41.090 --> 26:44.770]  the time and experience afforded to me to do something different from my day-to-day, possibly
[26:44.770 --> 26:49.470]  strike out on my own and start something new. I already did my own hobby-like startup for a
[26:49.470 --> 26:54.130]  decade and a half, and it ended up in the black, barely, and was sold when I lost the time to
[26:54.130 --> 26:58.490]  actively participate in a way that I wanted. If I start my own thing, it will be from skills acquired
[26:58.490 --> 27:03.290]  through doing everything. I think it's the best kind of skill sets to do this. It will help me
[27:03.290 --> 27:08.290]  with those I plan to hire, as well as learn what I need to take to make it in the marketplace.
[27:08.290 --> 27:12.050]  I'd have the budget, purchasing, management, sales and marketing, development, engineering,
[27:12.050 --> 27:15.930]  policy, and even some legal background in order to make a good go at it. The path is
[27:15.930 --> 27:21.670]  mine and yours to choose. This is the journey. This is your quest. Good luck and best wishes.
[27:21.670 --> 27:26.390]  Again, thanks to DEF CON, the new Career Hacking Village, and the staff and volunteers who helped
[27:26.390 --> 27:32.330]  with all of this. Such an amazing story. Really great inspiration. Thank you so much, Amelie,
[27:32.330 --> 27:39.430]  for sharing your story and your tips on how people can get from individual contributor to leader to
[27:39.430 --> 27:45.830]  individual career contributor, but also making sure that they're getting a fulfilled life and a
[27:45.830 --> 27:48.210]  life that they can give back. Thank you so much.
